ip6mr: call del_timer_sync() in ip6mr_free_table()

ip6mr: call del_timer_sync() in ip6mr_free_table()

commit 7ba0c47c34a1ea5bc7a24ca67309996cce0569b5 upstream.

We need to wait for the flying timers, since we
are going to free the mrtable right after it.

Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Ben Hutchings <ben@decadent.org.uk>
[ wt: 2.6.32 has a single table hence a single timer. ip6_mr_init() has
  the same del_timer() call on the error path, but we don't need to
  change it since at this point the timer hasn't been started yet ]
Signed-off-by: Willy Tarreau <w@1wt.eu>